fix(deploy): rewrite manifests to AceDataCloud platform conventions; site is live

[acedatacloud-dev]

PR #11–13 shipped manifests modeled on a generic K8s setup. None of those actually fit the AceDataCloud TKE cluster + nginx-router ingress + wildcard-cert convention, so when the user opened https://x402guard.acedata.cloud/ they got a Kubernetes Ingress Controller Fake Certificate + 404 (the LB had no rule for the host).

This PR aligns everything with the platform's conventions and the site is now live at https://x402guard.acedata.cloud/ with a real Let's Encrypt cert.

Conventions adopted (matching Wisdom + Nexior + MCPs/* in this org)

	before (PR #11)	after
namespace	x402guard	acedatacloud
ingress class	ingressClassName: nginx	kubernetes.io/ingress.class: nginx-router annotation
TLS secret	x402guard-tls + cert-manager annotation	tls-wildcard-acedata-cloud (already in cluster)
image-pull secret	missing	docker-registry
build tag	__BUILD__	${TAG} sed-substituted by run.sh
service names	api / web	x402guard-api / x402guard-web (avoid collision in shared ns)
storage class	cbs (default)	cbs-ssd (cbs is Immediate-binding zone-pinned, fails)

What lands

• Deleted: namespace.yaml, configmap.yaml (env values inlined into Deployment)
• Updated: api.yaml, web.yaml, ingress.yaml to platform conventions
• Updated: deploy/run.sh (sed ${TAG}, applies 4 yaml in order)
• New: postgres.yaml — single-replica StatefulSet on cbs-ssd / 10Gi PVC. Cluster has no shared Postgres; x402guard hosts its own.
• Updated: docker-compose.yaml service names → x402guard-api / x402guard-web so nginx upstream matches both environments
• Updated: web/deploy/nginx.conf proxy_pass to x402guard-api:8000

Live verification

$ curl -sS https://x402guard.acedata.cloud/health
  {"status":"ok","version":"0.1.0"}
$ curl -sS https://x402guard.acedata.cloud/.well-known/x402guard
  {"service":"x402guard","version":"0.1.0","cluster":"mainnet",
   "agent_vault_program_id":"5s9rscxc...","usdc_mint":"EPjFWdd5..."}
$ openssl s_client ... -showcerts | openssl x509 -noout -subject -issuer
  subject=CN=acedata.cloud
  issuer=Let's Encrypt E8

Pods (kubectl -n acedatacloud get pods -l app=x402guard):
  x402guard-api-...      1/1 Running  (×2)
  x402guard-postgres-0   1/1 Running
  x402guard-web-...      1/1 Running  (×2)

Bugs caught while bringing the cluster live

Worth recording so the next deploy doesn't hit them again:

• exec format error — docker compose build on macOS produces darwin/arm64 images. Cluster is amd64. Fix: docker buildx --platform linux/amd64 for the local-deploy fallback path. CI workflow already does this implicitly via docker/build-push-action.
• PVC Pending on cbs — cbs is Immediate-binding zone-pinned and the cluster's picked zone had no spare capacity. cbs-ssd uses WaitForFirstConsumer.
• cbs-ssd minimum is 10 Gi — 5 Gi requests fail with "disk size is invalid. Must in [10, 32000]".

Out of scope

• The CI workflow .github/workflows/deploy.yaml doesn't run yet (DEPLOY_TO_K8S repo var unset). This first deploy was driven from a workstation using the kubeconfig pulled via .claude/scripts/tke.py. Subsequent deploys go through CI once cluster credentials are loaded into the GHCR-secrets vault.